feat: actions/changelog-armed — the version-keyed arming guard #33

Merged

claude-bot-andresmgsl merged 1 commit from build/5-changelog-armed into main

2026-07-22 19:31:15 +00:00

claude-bot-andresmgsl commented

2026-07-22 19:22:53 +00:00

(Migrated from github.com)

Closes #5

Ports box's .github/scripts/changelog-armed.sh (at the issue's pinned ref) as actions/changelog-armed/ — the version-keyed arming guard, and the composite-action pattern #6 and #7 will copy.

What's here

actions/changelog-armed/changelog-armed.sh — the port, with the issue's three deltas: version read through version_read (#3, so the guard works for cast's package-json trees), the bare-version emptiness check through changelog_section (#4, so the guard and the publisher cannot disagree about what a section is), and version_is_dev as the single -dev definition (an rc keys as bare). Top-section detection, the $2-field parse, the failure messages, and the header essay are kept; references are de-repo-ified (#108 → box#108, release.yml → the release workflow, box's CONTRIBUTING pointer dropped) and the essay states this is the guard rig and cast regain at adoption (rig#44 / cast#108 reverts).
actions/changelog-armed/action.yml — composite; inputs version-source (default file) and changelog (default CHANGELOG.md) passed as env vars; one step runs the co-located script via $GITHUB_ACTION_PATH. The libs are sourced relative to the script — a consumer's uses: fetch brings the whole repo at the pinned ref, so no skew is possible. The description says to check out the consumer's repo first.
test/changelog-armed.test.sh — 18 checks: the issue's full matrix (both -dev rows, all four bare shapes including the empty stamp and the half-ceremony, the no-sections / missing-file degenerates, both backends) plus rc-keys-as-bare, whole-version rc non-match, unknown backend, and the env-var wiring action.yml relies on.
ci.yml — a new action-exercise job drives uses: ./actions/changelog-armed against a scratch armed tree after checkout, proving the composite wiring itself.

No CHANGELOG.md entry: the repo's changelog arrives with #11 (same sequencing as #28/#29/#31).

Acceptance criteria

Action + script land as spec'd; tests pass in CI; shellcheck/actionlint clean — 18/18 locally, full suite 5/5 files, both sweeps clean; CI pending on this PR.
The action works when exercised from a scratch workflow in this repo's CI via uses: ./actions/changelog-armed after checkout — the action-exercise job.
Header comment preserves the box#108 / rig#66 / rig#44 / cast#108 history and states this is the guard rig and cast will regain.

Note for reviewers

Issue #5 sat blocked on #3/#4, both merged; I corrected the stale label per LABELS.md ("anyone may correct it") and claimed — see the issue comment.

Closes #5 Ports box's `.github/scripts/changelog-armed.sh` (at the issue's pinned ref) as `actions/changelog-armed/` — the version-keyed arming guard, and the composite-action pattern #6 and #7 will copy. ## What's here - **`actions/changelog-armed/changelog-armed.sh`** — the port, with the issue's three deltas: version read through `version_read` (#3, so the guard works for cast's package-json trees), the bare-version emptiness check through `changelog_section` (#4, so the guard and the publisher cannot disagree about what a section is), and `version_is_dev` as the single `-dev` definition (an rc keys as bare). Top-section detection, the `$2`-field parse, the failure messages, and the header essay are kept; references are de-repo-ified (`#108` → `box#108`, `release.yml` → the release workflow, box's CONTRIBUTING pointer dropped) and the essay states this is the guard rig and cast regain at adoption (rig#44 / cast#108 reverts). - **`actions/changelog-armed/action.yml`** — composite; inputs `version-source` (default `file`) and `changelog` (default `CHANGELOG.md`) passed as env vars; one step runs the co-located script via `$GITHUB_ACTION_PATH`. The libs are sourced relative to the script — a consumer's `uses:` fetch brings the whole repo at the pinned ref, so no skew is possible. The description says to check out the consumer's repo first. - **`test/changelog-armed.test.sh`** — 18 checks: the issue's full matrix (both `-dev` rows, all four bare shapes including the empty stamp and the half-ceremony, the no-sections / missing-file degenerates, both backends) plus rc-keys-as-bare, whole-version rc non-match, unknown backend, and the env-var wiring action.yml relies on. - **`ci.yml`** — a new `action-exercise` job drives `uses: ./actions/changelog-armed` against a scratch armed tree after checkout, proving the composite wiring itself. No `CHANGELOG.md` entry: the repo's changelog arrives with #11 (same sequencing as #28/#29/#31). ## Acceptance criteria - [x] Action + script land as spec'd; tests pass in CI; shellcheck/actionlint clean — 18/18 locally, full suite 5/5 files, both sweeps clean; CI pending on this PR. - [x] The action works when exercised from a scratch workflow in this repo's CI via `uses: ./actions/changelog-armed` after checkout — the `action-exercise` job. - [x] Header comment preserves the box#108 / rig#66 / rig#44 / cast#108 history and states this is the guard rig and cast will regain. ## Note for reviewers Issue #5 sat `blocked` on #3/#4, both merged; I corrected the stale label per LABELS.md ("anyone may correct it") and claimed — see the issue comment.

danmt (Migrated from github.com) reviewed 2026-07-22 19:22:53 +00:00

grok-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 19:24:55 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Approve — I agree with this as-is.

First review of tip dde6b25. Closes #5.

What holds

Version-keyed arming preserves the box#108 / rig#66 lesson and states the rig#44 / cast#108 reverts of the naive “always ## Unreleased” form.
Three #5 deltas: version_read (file + package-json), changelog_section for non-empty bare section (half-ceremony refuse), version_is_dev so rc keys as bare.
Bare rules: top may be Unreleased or exactly $ver; wrong number refused; empty stamp refused via the publisher’s extractor (guard and notes cannot disagree).
Composite: inputs → env; script co-located; libs via $here/../../lib at the same ref as the action (no skew). Description requires consumer checkout first.
CI action-exercise: constructs a scratch armed tree and runs uses: ./actions/changelog-armed — proves action.yml + $GITHUB_ACTION_PATH wiring the unit tests cannot.
Tests: matrix covers -dev, bare shapes, half-ceremony, empty stamp, rc whole-version, backends, env wiring. CI test + action-exercise green.

No CHANGELOG yet matches #11 sequencing. No blockers.

**Verdict: Approve** — I agree with this as-is. First review of tip `dde6b25`. Closes #5. ### What holds - **Version-keyed arming** preserves the box#108 / rig#66 lesson and states the rig#44 / cast#108 reverts of the naive “always `## Unreleased`” form. - **Three #5 deltas:** `version_read` (file + package-json), `changelog_section` for non-empty bare section (half-ceremony refuse), `version_is_dev` so rc keys as bare. - **Bare rules:** top may be Unreleased or exactly `$ver`; wrong number refused; empty stamp refused via the publisher’s extractor (guard and notes cannot disagree). - **Composite:** inputs → env; script co-located; libs via `$here/../../lib` at the same ref as the action (no skew). Description requires consumer checkout first. - **CI `action-exercise`:** constructs a scratch armed tree and runs `uses: ./actions/changelog-armed` — proves action.yml + `$GITHUB_ACTION_PATH` wiring the unit tests cannot. - **Tests:** matrix covers -dev, bare shapes, half-ceremony, empty stamp, rc whole-version, backends, env wiring. CI `test` + `action-exercise` green. No CHANGELOG yet matches #11 sequencing. No blockers.

kimi-bot-andresmgsl commented

2026-07-22 19:25:48 +00:00

(Migrated from github.com)

🔎 reviewing head dde6b25

🔎 reviewing head dde6b25

kimi-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 19:28:14 +00:00

kimi-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Approve — head dde6b25. Closes #5.

Verified, not just read:

Tests: test/changelog-armed.test.sh 18/18 where the runner has node. The 2 local package-json failures are my box lacking node (version_read: node is required) — the same absence fails pre-existing version tests on main, and CI's test job (with CEREMONY_REQUIRE_NPM: 1) is green, so those rows genuinely ran there.
CI: test (shellcheck + actionlint + suite) and action-exercise both pass on this head. The action-exercise job satisfies the acceptance criterion the unit tests can't — uses: ./actions/changelog-armed, $GITHUB_ACTION_PATH, relative lib sourcing.
Adversarial probes I ran myself: bare version + armed top + empty stamped section below → correctly refused via changelog_section (the publisher can't disagree); stamped-own-version on top with a stray ## Unreleased lower down → correctly passes (both ceremony shapes legal, the rig#44/cast#108 lesson).
Verbatim-message claim: diffed against box's script at the issue's pinned ref (a17903f). Messages and the header essay carry over faithfully with the stated de-repo-ification; incident numbers (box#108, rig#66, rig#44, cast#108, rig#67) intact, and the essay states this is the guard rig and cast regain.
Issue deltas: version_read for both backends, changelog_section for the emptiness check, version_is_dev so rc keys as bare (tested — rc section never satisfies the bare version, own rc stamp ships). Whole-version matching holds.
Test matrix: matches the issue's list row for row, both backends included.
Conventions: set -euo pipefail / set -u split correct, mawk-safe awk, comments carry the why.

No CHANGELOG entry matches the #11 sequencing. No blockers.

**Verdict: Approve** — head `dde6b25`. Closes #5. Verified, not just read: - **Tests**: `test/changelog-armed.test.sh` 18/18 where the runner has node. The 2 local package-json failures are my box lacking node (`version_read: node is required`) — the same absence fails pre-existing version tests on main, and CI's `test` job (with `CEREMONY_REQUIRE_NPM: 1`) is green, so those rows genuinely ran there. - **CI**: `test` (shellcheck + actionlint + suite) and `action-exercise` both pass on this head. The `action-exercise` job satisfies the acceptance criterion the unit tests can't — `uses: ./actions/changelog-armed`, `$GITHUB_ACTION_PATH`, relative lib sourcing. - **Adversarial probes I ran myself**: bare version + armed top + *empty* stamped section below → correctly refused via `changelog_section` (the publisher can't disagree); stamped-own-version on top with a stray `## Unreleased` lower down → correctly passes (both ceremony shapes legal, the rig#44/cast#108 lesson). - **Verbatim-message claim**: diffed against box's script at the issue's pinned ref (`a17903f`). Messages and the header essay carry over faithfully with the stated de-repo-ification; incident numbers (box#108, rig#66, rig#44, cast#108, rig#67) intact, and the essay states this is the guard rig and cast regain. - **Issue deltas**: `version_read` for both backends, `changelog_section` for the emptiness check, `version_is_dev` so rc keys as bare (tested — rc section never satisfies the bare version, own rc stamp ships). Whole-version matching holds. - **Test matrix**: matches the issue's list row for row, both backends included. - **Conventions**: `set -euo pipefail` / `set -u` split correct, mawk-safe awk, comments carry the why. No CHANGELOG entry matches the #11 sequencing. No blockers.

codex-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 19:29:39 +00:00

codex-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: I agree with everything and have no additional feedback.

Head dde6b25 satisfies #5: the version-keyed guard preserves both legal bare-version shapes, rejects empty/missing/misnumbered sections through the shared extractor, treats only -dev as development, and keeps whole-version matching. The composite action passes inputs via environment variables, sources co-located libraries at the pinned action ref, and documents the consumer checkout requirement. The contract matrix, shellcheck/actionlint suite, and local-action exercise are all green; the explicit no-CHANGELOG exception matches the #11 sequencing.

Verdict: I agree with everything and have no additional feedback. Head dde6b25 satisfies #5: the version-keyed guard preserves both legal bare-version shapes, rejects empty/missing/misnumbered sections through the shared extractor, treats only -dev as development, and keeps whole-version matching. The composite action passes inputs via environment variables, sources co-located libraries at the pinned action ref, and documents the consumer checkout requirement. The contract matrix, shellcheck/actionlint suite, and local-action exercise are all green; the explicit no-CHANGELOG exception matches the #11 sequencing.

claude-bot-andresmgsl commented

2026-07-22 19:30:55 +00:00

(Migrated from github.com)

Round summary — converged, handing off

What shipped (head dde6b25): actions/changelog-armed/ — box's version-keyed arming guard ported as a composite action, with the three #5 deltas: version read through version_read (file + package-json backends), the bare-version emptiness check through changelog_section (guard and publisher share one section definition), and version_is_dev as the single -dev test (rc keys as bare). Plus test/changelog-armed.test.sh (18 checks, the issue's matrix row for row) and a CI action-exercise job that drives uses: ./actions/changelog-armed against a scratch armed tree.

Rounds: one. All three panel verdicts (grok, kimi, codex) approved the first head dde6b25 with no changes requested — no fixup commits, the reviewed head is the current head.

What was verified:

CI green on this head: test (shellcheck + actionlint + full suite, 5/5 files) and action-exercise — the latter proving the action.yml / $GITHUB_ACTION_PATH / relative-lib wiring the unit tests can't reach.
kimi re-ran the suite, diffed the script against box's pinned ref a17903f (messages and header essay verbatim modulo the stated de-repo-ification, incident numbers intact), and ran adversarial probes: empty stamped section under an armed top → refused; stamped-own-version with a stray lower ## Unreleased → passes (both ceremony shapes legal, the rig#44/cast#108 lesson).
grok confirmed the bare rules (Unreleased or exactly $ver on top, wrong number refused, empty stamp refused via the publisher's extractor) and the no-skew lib sourcing.
All three confirmed the deliberate no-CHANGELOG-entry exception matches the #11 sequencing (same as #28/#29/#31).

Post-merge residue:

No CHANGELOG.md entry by design — the repo's changelog arrives with #11.
#6 and #7 are unblocked by this merge and will copy this composite-action pattern.
The header essay states cast regains the guard at adoption (rig#44 / cast#108 reverts) — that's tracked downstream, nothing pending here.

Requesting @danmt's review and setting state:needs-human. Over to you.

## Round summary — converged, handing off **What shipped** (head `dde6b25`): `actions/changelog-armed/` — box's version-keyed arming guard ported as a composite action, with the three #5 deltas: version read through `version_read` (file + package-json backends), the bare-version emptiness check through `changelog_section` (guard and publisher share one section definition), and `version_is_dev` as the single `-dev` test (rc keys as bare). Plus `test/changelog-armed.test.sh` (18 checks, the issue's matrix row for row) and a CI `action-exercise` job that drives `uses: ./actions/changelog-armed` against a scratch armed tree. **Rounds**: one. All three panel verdicts (grok, kimi, codex) approved the first head `dde6b25` with no changes requested — no fixup commits, the reviewed head is the current head. **What was verified**: - CI green on this head: `test` (shellcheck + actionlint + full suite, 5/5 files) and `action-exercise` — the latter proving the action.yml / `$GITHUB_ACTION_PATH` / relative-lib wiring the unit tests can't reach. - kimi re-ran the suite, diffed the script against box's pinned ref `a17903f` (messages and header essay verbatim modulo the stated de-repo-ification, incident numbers intact), and ran adversarial probes: empty stamped section under an armed top → refused; stamped-own-version with a stray lower `## Unreleased` → passes (both ceremony shapes legal, the rig#44/cast#108 lesson). - grok confirmed the bare rules (Unreleased or exactly `$ver` on top, wrong number refused, empty stamp refused via the publisher's extractor) and the no-skew lib sourcing. - All three confirmed the deliberate no-CHANGELOG-entry exception matches the #11 sequencing (same as #28/#29/#31). **Post-merge residue**: - No `CHANGELOG.md` entry by design — the repo's changelog arrives with #11. - #6 and #7 are unblocked by this merge and will copy this composite-action pattern. - The header essay states cast regains the guard at adoption (rig#44 / cast#108 reverts) — that's tracked downstream, nothing pending here. Requesting @danmt's review and setting `state:needs-human`. Over to you.